AI导哈

数据保护影响评估MCP服务器

DPIA MCP Lite 是一个数据保护影响评估MCP服务器，帮助AI代理扫描代码库中的个人数据处理、评估风险、检查GDPR合规性并生成结构化DPIA文档，适用于挪威及欧盟项目的隐私合规与数据保护评估场景。

  • by Qvakk
  • Python
  • 混合部署
  • 更新于
在 GitHub 查看 Qvakk/dpia-lite-mcp

使用说明

DPIA MCP Lite

An MCP server that helps an AI agent carry out a Data Protection Impact Assessment (DPIA) for Norwegian projects: it scans a codebase for personal-data processing, scores the risk, checks GDPR compliance against an organisation baseline, and generates a structured DPIA document — with the relevant Norwegian and EU legal sources embedded.

No ML dependencies. The legal knowledge base and templates are plain Python data, so the image stays small and the server runs without any external API.

Built on the MCP Python SDK 2.x (MCPServer with @mcp.tool() decorators). Both stdio and Streamable HTTP transports are supported.

Quick start

uv venv && uv pip install -e .
TRANSPORT=http HTTP_PORT=8000 python -m dpia_mcp_lite.server

Or with Docker:

docker compose up --build      # http://localhost:8000/mcp

Add to an MCP client:

{
  "servers": {
    "dpia-lite": {
      "type": "http",
      "url": "http://localhost:8000/mcp"
    }
  }
}

For stdio clients, run python -m dpia_mcp_lite.server with TRANSPORT=stdio (the default).

Tools

Tool Purpose
analyze_codebase_for_dpia Scan a directory for personal-data processing, storage, third-party integrations, tracking, encryption and access control
analyze_code_snippets Same analysis on code passed as strings
assess_processing_risk Risk score from likelihood × impact × data sensitivity, per Datatilsynet methodology
check_gdpr_compliance Check a described processing activity against GDPR requirements
generate_dpia_template Structured DPIA document pre-filled with the project's findings
recommend_safeguards Concrete measures for identified risks
search_documentation Query the embedded Norwegian/EU legal knowledge base
get_org_baseline The organisation's baseline: mandatory frameworks, required controls, forbidden patterns
lookup_norwegian_law Look up a specific Norwegian act or provision

Resources: legal://norway/overview, legal://norway/personopplysningsloven, legal://norway/gdpr, legal://eu/ai-act.

Prompt: dpia_assessment — a ready-made DPIA prompt for a named project.

Organisation baseline

The server reads a baseline profile that decides which frameworks are mandatory, which controls must be present, which patterns are forbidden, and when a DPIA is required.

Resolution order (first hit wins):

  1. DPIA_ORG_PROFILE — path to a profile JSON
  2. /app/org-profile.json — baked into the image
  3. org-profile.json in the project root — local development
  4. Built-in default — always usable, never fails

The tracked org-profile.json is a neutral public-sector sample. Replace it with your own, or keep your real baseline out of the repository:

# .gitignore already covers *.local.json
cp org-profile.json org-profile.local.json   # edit freely
export DPIA_ORG_PROFILE=./org-profile.local.json

Any field you omit is inherited from the built-in default, so a profile can be as small as {"name": "Acme AS"}.

Configuration

Variable Default Purpose
TRANSPORT stdio stdio or http
HTTP_HOST 0.0.0.0 Bind address (HTTP)
HTTP_PORT 8000 Listen port (HTTP)
PUBLIC_URL – Informational; logged at startup
DPIA_ORG_PROFILE – Path to an alternative baseline
DPIA_ALLOWED_HOSTS – Space-separated FQDNs for DNS-rebinding protection. Set this in production behind a reverse proxy, or the guard stays disabled

Health probes: /health, /healthz, /ready.

Legal sources

The knowledge base covers GDPR, personopplysningsloven, ePrivacy, eIDAS, NIS2 (digitalsikkerhetsloven), sikkerhetsloven, helsepersonelloven, finanstilsynet requirements and the EU AI Act, with references to Lovdata and Datatilsynet.

The embedded text is a convenience copy, not legal advice. Verify every citation against Lovdata before relying on it in a decision.

Limitations

  • The code analyser uses pattern matching, not dataflow analysis. It finds signals worth reviewing, not a definitive inventory.
  • The risk calculator implements one methodology. It does not replace a documented assessment by the data protection officer.
  • A DPIA is a legal process with documentation, consultation and sign-off. This tool prepares the draft; it does not approve anything.

Development

uv pip install -e ".[dev]"
ruff check src
mypy src

scripts/smoke-dpia.mjs drives the HTTP surface end to end:

node scripts/smoke-dpia.mjs http://127.0.0.1:8000

Licence

MIT — see LICENSE.

相关 MCP